Detections
Analytics
Comersus Cart /comersus/database/comersus.mdb Direct Request Datbase Disclosure
medium Nessus Plugin ID 20130
Language:
Synopsis
The remote web server contains an ASP application that is prone to an information disclosure attack.Description
The remote host appears to be running Comersus Cart, an ASP shopping cart application.The version of Comersus Cart installed on the remote host fails to restrict access to its customer database, which contains order information, passwords, credit card numbers, etc. Further, the data in all likelihood can be decrypted trivially since the application reportedly uses the same default password for each version of the application to encrypt and decrypt data.
Solution
Unknown at this time.See Also
Plugin Details
Severity: Medium
ID: 20130
File Name: comersus_db_download.nasl
Version: 1.27
Type: remote
Family: CGI abuses
Published: 11/2/2005
Updated: 4/7/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Required KB Items: www/ASP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/31/2005